Audit a Confium deployment

Audit checklist

The following items should be verified during a Confium deployment audit. Each item maps to a standard control framework (SOC 2 CC, ISO 27001 Annex A, NIST 800-53).

#	Check	Evidence	Framework
1	Quorum policy matches governance requirements	Deployment manifest TOML	SOC 2 CC6.1
2	Share storage is encrypted at rest	Signer configuration + key store audit	SOC 2 CC6.7
3	Transparency log is append-only and externally verifiable	Inclusion proof for sample entries	SOC 2 CC7.2
4	Coordinator is deployed redundantly (HA)	Infrastructure diagram + health check output	ISO 27001 A.17.1
5	Proactive share refresh runs on schedule	Cron / systemd timer logs + audit log entries	NIST AU-6
6	FIPS mode is enabled if required	Confium::Policy.fips_mode value in audit log	FIPS 140-2
7	Algorithm allow-list matches jurisdictional requirements	Policy TOML section	eIDAS / FedRAMP
8	Witness gossip is operational	Witness logs showing no divergence alerts	SOC 2 CC7.2
9	OTS anchoring in Bitcoin is current	Latest OTS proof timestamp	SOC 2 CC7.3
10	Audit log is tamper-evident	Transparency log consistency proof from audit log to current root	SOC 2 CC7.2
11	Signer identities are attribute-verified	Identity backend configuration + signer attribute records	SOC 2 CC6.1
12	Key ceremony was conducted with required witnesses	Ceremony documentation + transparency log entry for key generation	NIST SC-12

Evidence collection guide

For each audit item, collect the following evidence:

Coordinator state

# Current coordinator version and configuration
confiumd --version
cat /etc/confium/daemon.toml

# Active signers
curl --unix-socket /var/run/confium.sock \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"list_signers","id":1}'

Transparency log state

# Current tree root and size
confium-log root
confium-log size

# Verify inclusion for a sample entry
confium-log inclusion-proof --sequence 12345 | confium-log verify

Policy and FIPS mode

# Read the active policy
confium config get fips_mode
confium config get allowed_signature_algorithms

Audit log

# Export recent audit events
confium-log export --from 2026-01-01 --to 2026-07-28 --format json > audit-export.json

# Verify the export is anchored in the transparency log
confium-log verify-export --file audit-export.json

Witness state

# Check witness health
confium witness status --peers coord-eu.internal,coord-apac.internal

# Verify no divergence detected
confium witness log --grep divergence

Common findings and remediation

Finding	Risk	Remediation
Share refresh not running on schedule	Long-running share aggregation attack window	Enable confium-tc-reshare on monthly cron; verify in audit log.
Single coordinator (no HA)	Coordinator failure halts all signing	Deploy a second coordinator in a different availability zone.
FIPS mode not enabled	Non-validated crypto in regulated environments	Set fips_mode = true in deployment manifest; use Botan FIPS plugin.
Witness gossip disabled	Split-view attacks undetectable	Deploy witnesses per region; configure gossip interval (default: 1 hour).
OTS anchoring stale	No irrefutable time proof for recent entries	Verify OTS calendar endpoint; check last anchor timestamp.
Key ceremony undocumented	No evidence that key generation followed governance	Document ceremony participants, timestamps, and transparency log entry.

Independent verification

Auditors should not trust the operator's word. Verify independently:

1. Transparency log: compute the Merkle root from the raw entries and compare to the published root.
2. Inclusion proofs: verify 3-5 random entries' inclusion proofs against the root.
3. OTS anchors: verify Bitcoin transaction timestamps independently via a blockchain explorer.
4. Policy compliance: cross-reference the deployment manifest with the jurisdictional requirements.
5. Key ceremony: verify the transparency log entry for key generation matches the documented ceremony.

Framework mapping

Framework	Confium coverage
SOC 2 Type II	CC6.1 (access), CC6.7 (encryption), CC7.2 (monitoring), CC7.3 (incident response)
ISO 27001	A.8.24 (cryptography), A.17.1 (continuity), A.8.15 (logging)
NIST 800-53	SC-12 (key establishment), AU-6 (audit review), SI-2 (flaw remediation)
FedRAMP	Requires FIPS 140-2 validated crypto + structured audit log
eIDAS	Qualified Electronic Signature requirements (P-384+, audit trail, long-term verifiability)

Where to go next

• Security model — the threat table and defense layers.
• Compliance officer guide — for the deployment-side counterpart.
• Compliance docs — FIPS, jurisdictional policies, audit format.
• Transparency logs — how to independently verify.